Zareian
663252a260
accounts.0008 drops the columns and refuses to run while guest rows exist. Docs describe the current state; tests that only proved guest behaviour are gone. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
61 lines
2.6 KiB
Python
61 lines
2.6 KiB
Python
"""
|
||
POST /api/user/delete — حذفِ حسابِ خود (۲۰۲۶-۱۰-۰۲). راههای شکستن: حذف با توکنِ تنها
|
||
(بیکد)، حدسِ کد، حذفِ حسابِ دمو، و پاک شدنِ سندِ مالی.
|
||
"""
|
||
from django.core.cache import cache
|
||
from django.test import TestCase, override_settings
|
||
from django.utils import timezone
|
||
from rest_framework.test import APIClient
|
||
|
||
from accounts.authentication import issue_access_token
|
||
from accounts.models import OTPCode, User
|
||
from payment.models import Order
|
||
from progress.models import UserStats
|
||
|
||
|
||
def _client(user):
|
||
client = APIClient()
|
||
client.credentials(HTTP_AUTHORIZATION=f'Bearer {issue_access_token(user.id)}')
|
||
return client
|
||
|
||
|
||
class DeleteAccountTests(TestCase):
|
||
def setUp(self):
|
||
cache.clear()
|
||
self.user = User.objects.create(phone='09121115001')
|
||
UserStats.objects.create(user_id=self.user.id, xp=50)
|
||
self.client = _client(self.user)
|
||
|
||
def code(self, value='482913'):
|
||
OTPCode.objects.create(phone=self.user.phone, code=value,
|
||
expires_at=timezone.now() + timezone.timedelta(minutes=5))
|
||
return value
|
||
|
||
def delete(self, **body):
|
||
return self.client.post('/api/user/delete', body, format='json')
|
||
|
||
def test_a_token_alone_is_not_enough(self):
|
||
self.assertEqual(self.delete().status_code, 400)
|
||
self.assertTrue(User.objects.filter(pk=self.user.pk).exists())
|
||
|
||
def test_a_wrong_code_deletes_nothing(self):
|
||
self.code()
|
||
self.assertEqual(self.delete(otp='111111').status_code, 400)
|
||
self.assertTrue(User.objects.filter(pk=self.user.pk).exists())
|
||
|
||
def test_the_right_code_deletes_everything_but_payment_records(self):
|
||
Order.objects.create(user_id=self.user.id, amount=99000, status='paid', idempotency_key='k')
|
||
response = self.delete(otp=self.code())
|
||
self.assertEqual(response.status_code, 200, response.content)
|
||
self.assertFalse(User.objects.filter(pk=self.user.pk).exists())
|
||
self.assertFalse(UserStats.objects.filter(user_id=self.user.pk).exists())
|
||
self.assertTrue(Order.objects.filter(user_id=self.user.pk).exists())
|
||
# توکنِ قبلی دیگر به هیچ کاربری نمیرسد.
|
||
self.assertIn(self.client.get('/api/user/profile').status_code, (401, 403))
|
||
|
||
|
||
@override_settings(TEST_LOGIN_PHONES={'09121115001': '4321'})
|
||
def test_demo_accounts_cannot_be_deleted(self):
|
||
self.assertEqual(self.delete(otp='4321').status_code, 403)
|
||
self.assertTrue(User.objects.filter(pk=self.user.pk).exists())
|